CVE-2017-20229

EUVD-2017-18951
MAWK 1.3.3-17 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting inadequate boundary checks on user-supplied input. Attackers can craft malicious input that overflows the stack buffer and execute a return-oriented programming chain to spawn a shell with application privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 49.6%
Affected Products (NVD)
VendorProductVersion
invisible-islandmawk
𝑥
≤ 1.3.3-17
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
mawk
bookworm
undetermined
bullseye
undetermined
forky
undetermined
sid
undetermined
trixie
undetermined
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mawk
bionic
needed
focal
not-affected
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
stonking
not-affected
trusty
needed
xenial
needed